CVE-2026-119706
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InternLM LMDeploy versions 0.9.0 to 0.18.0 contain an unauthenticated remote code execution vulnerability, allowing remote attackers to run OS commands.
- Affected
- {'products': ['InternLM LMDeploy'], 'packages': [], 'versions': ['0.9.0', '0.10.0', '0.11.0', '0.12.0', '0.13.0', '0.14.0', '0.15.0', '0.16.0', '0.17.0', '0.18.0']}
- Fix
- Check the linked advisory for a fix; upgrade to a non-affected version
- Exploitation
- No known exploitation
Not confirmed. 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.14.0, 0.15.0, 0.16.0, 0.17.0 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/InternLM/lmdeploy
- https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60
- https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345
- https://github.com/InternLM/lmdeploy/issues/4698
- https://github.com/InternLM/lmdeploy/pull/4964
- https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization
- https://github.com/InternLM/lmdeploy/issues/4698
Original description
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Last activity 30 Oct 2026. Patch Forecast updates every hour.